CVE-2026-82306mediumCWE-200

StarRocks Query Detail Endpoint Returns Every User's Query History

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.5%

probabilidad de explotación

0.5%top 56% de las CVE

explotación observada

noninguna fuente lo reporta

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Productos afectados

StarRocks · starrocks

Referencias

https://github.com/StarRocks/starrocks https://github.com/StarRocks/starrocks/blob/4.0.13/fe/fe-core/src/main/java/com/starrocks/http/rest/QueryDetailAction.java https://github.com/StarRocks/starrocks/issues/75747 https://www.vulncheck.com/advisories/starrocks-query-detail-endpoint-returns-every-user-s-query-history